Sensor settings

Use the sensor Settings page to update the sensor location, make annotations and enable or disable Packet Capture. You can also access the sensor settings from the Actions menu on the Sensors page.

Requirements:

• You must have Admin privileges to edit the sensor settings.

To edit the settings from the Sensors page:

1. On the Sensors page, click the actions menu at the right side of the page and click Edit.

   

2. Update the Sensor details and click Update.

   Option	Description
   Location	Update the sensor location.
   Annotations	Enter keywords about the sensors. To add annotation, type the phrase or keyword and press Tab or Enter. Annotations with an orange background are internal an cannot be edited. Annotations with a blue background can be added or deleted.
   PCAP Enabled	Enable packet capture. For more information, see Packet capture.
   Packet Inspection Engine	Suricata: A Suricata event is created when Suricata (an intrusion detection tool) alerts or metadata are integrated into Zeek logs, highlighting threat detection signatures and behaviors. See, Suricata fields. Fortinet DPI: A DPI (Deep Packet Inspection) event is created by the Fortinet IPS (Intrusion Prevention System) engine running on the sensor which logs informative and pattern matching based events. The IPS engine logs AppID (Applications seen by the engine for software and protocols), IDS (signatures for vulnerabilities), OT Protocols/Threats (Operational Technology based protocol parsing and signatures), Botnet (Botnet based traffic patterns), and Info (informational events about protocols). See,DPI fields.

To edit the sensor settings:

1. Go to Settings > Sensors. The Sensor page opens.
2. Click the Sensor ID. The sensor Status page opens.
3. Click the Settings tab.
4. Click Edit General Settings to edit the sensor Location and Labels.

   Option	Description
   Location	Update the sensor location.
   Labels	Enter keywords about the sensors. To add annotation, type the phrase or keyword and press Tab or Enter. Annotations with an orange background are internal an cannot be edited. Annotations with a blue background can be added or deleted.

5. Click Edit Features Settings to enable/disable Packet Capture.

   Option	Description
   PCAP Enabled	Enable packet capture. For more information, see Packet capture.
   Packet Inspection Engine	Enable the one or more of the following options: Suricata Payloads Fortinet DPI Payloads File Scanning When these features are enabled, they appear in the Features column of the sensor list.

Packet Inspection Engine Guidelines

VM Sensors	To run Suricata and Fortinet DPI engines concurrently, the following minimum recommended system resources are required: CPU: 24 cores RAM: 48 GB
Physical Sensors	Enabling DPI on physical sensors depends on available system resources. Customers should contact the support team for confirmation and guidance.